Remove the vpicc and virt features that are used for testing and should not be public

.github/workflows/ci.yaml

@@ -13,12 +13,29 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-
+    container: ghcr.io/trussed-dev/piv-authenticator
+    permissions:
+      contents: read
+      packages: read
     steps:
       - uses: actions/checkout@master
+      - name: start pcscd
+        run: pcscd -d -f --disable-polkit
+        id: pcscd
+        background: true
       - name: Install rust
         run: rustup show active-toolchain || rustup toolchain install
-      - name: Run checks
-        run: make lint
       - name: Run tests
-        run: make test TEST_FEATURES="rsa,virt"
+        run: make ci
+      - name: Upload tarpaulin html report
+        uses: actions/upload-artifact@v7
+        with:
+          name: tarpaulin-html-report
+          path: tarpaulin-report.html
+      - name: Upload tarpaulin xml report
+        uses: actions/upload-artifact@v7
+        with:
+          name: tarpaulin-xml-report
+          path: tarpaulin-report.xml
+      - name: Stop pcscd
+        cancel: pcscd

Cargo.toml

@@ -1,3 +1,7 @@
+[workspace]
+resolver = "3"
+members = ["dev-vpicc"]
+
 [package]
 name = "piv-authenticator"
 version = "0.6.0"
@@ -9,65 +13,54 @@ documentation = "https://docs.rs/piv-authenticator"
 
 [[example]]
 name = "vpicc"
-required-features = ["vpicc"]
+required-features = []
 
 [dependencies]
 apdu-app = { version = "0.2", optional = true }
 cbor-smol = { version = "0.5", features = ["heapless-bytes-v0-5"] }
 delog = { version = "0.1.5", optional = true }
 flexiber = { version = "0.2", features = ["derive", "heapless"] }
 heapless = "0.9.1"
-hex-literal = "0.3"
+hex-literal = "1"
 iso7816 = "0.2.0"
 serde = { version = "1", default-features = false, features = ["derive"] }
-trussed = { version = "0.1", default-features = false, features = ["aes256-cbc", "chacha8-poly1305", "crypto-client", "ed255", "filesystem-client", "p256", "p384", "shared-secret", "serde-extensions", "tdes", "x255"], optional = true }
 trussed-auth = "0.5"
-trussed-auth-backend = { version = "0.1.0", optional = true }
 untrusted = "0.9"
-vpicc = { version = "0.1.0", optional = true }
 log = "0.4"
 heapless-bytes = "0.5.0"
 subtle = { version = "2", default-features = false }
 # TODO: only enable rsa features when needed
 trussed-core = { version = "0.2", features = ["aes256-cbc", "chacha8-poly1305", "crypto-client", "ed255", "filesystem-client", "p256", "p384", "rsa2048", "rsa3072", "rsa4096", "shared-secret", "tdes", "x255"] }
 trussed-rsa-types = { version = "0.2", optional = true }
-trussed-rsa-alloc = { version = "0.4", features = ["raw"], optional = true }
 trussed-chunked = "0.3.0"
 trussed-hpke = "0.3.0"
 trussed-wrap-key-to-file = "0.3.0"
-trussed-staging = { version = "0.4", features = ["chunked", "hpke", "wrap-key-to-file"], default-features = false, optional = true }
 littlefs2-core = "0.1.0"
-cfg-if = "1.0.0"
 
 [dev-dependencies]
-rand_core = { version = "0.6", features = ["getrandom"] }
-trussed = { version = "0.1.0", features = ["virt"] }
-env_logger = "0.9"
+dev-vpicc = { path = "dev-vpicc" }
+vpicc = "0.1.0"
+rand_core = { version = "0.10" }
+env_logger = "0.10"
 serde = { version = "1", features = ["derive"] }
 serde_cbor = { version = "0.11", features = ["std"] }
 hex  = "0.4"
 test-log = "0.2.11"
 ron  = "0.8"
-des = "0.8"
-aes = "0.8.2"
+des = "0.9"
+aes = "0.9.2"
 stoppable_thread = "0.2.1"
-expectrl = "0.7.0"
+expectrl = "0.9.0"
 iso7816 = { version = "0.2", features = ["std"] }
 
 # Examples
 # usbip
-rand = "0.8.5"
-asn1 = "0.15.2"
+rand = "0.10"
+asn1 = "0.24.1"
 
 [features]
 default = []
 apdu-dispatch = ["dep:apdu-app"]
-strict-pin = []
-std = []
-vpicc = ["std", "dep:vpicc", "virt", "dep:trussed-auth-backend"]
-virt = ["std", "trussed/virt", "dep:trussed-staging", "dep:trussed-auth-backend", "dep:trussed-rsa-alloc"]
-pivy-tests = []
-opensc-tests = []
 alloc = []
 rsa = ["dep:trussed-rsa-types", "alloc"]
 delog  = ["dep:delog"]
@@ -80,8 +73,6 @@ log-info = []
 log-warn = []
 log-error = []
 
-dangerous-test-real-card = []
-
 [patch.crates-io]
 trussed = { git = "https://github.com/trussed-dev/trussed", rev = "0f8df68be879acdde1f8cf428c11e5d29692a47b" }
 trussed-auth-backend = { git = "https://github.com/trussed-dev/trussed-auth", tag = "backend-v0.1.0" }

Makefile

@@ -3,9 +3,9 @@
 -include variables.mk
 
 export RUST_LOG ?= info,cargo_tarpaulin=off
-TEST_FEATURES ?=vpicc,pivy-tests,opensc-tests,rsa
+TEST_FEATURES ?= rsa
 export PIV_DANGEROUS_TEST_CARD_READER ?= Virtual PCD 00 00
-export PIV_DANGEROUS_TEST_CARD_PIV_SERIAL ?= 04 B2 BB FB 54 40 4A E3 9B B8 6A E3 CA 82 9C 24
+export PIV_DANGEROUS_TEST_CARD_PIV_SERIAL ?= 99 37 9A 79 9E DC 48 1E A5 3E 11 CF EF 74 47 62
 
 .PHONY: build-cortex-m4
 build-cortex-m4:
@@ -17,7 +17,7 @@ test:
 
 .PHONY: dangerous-test-real-card
 dangerous-test-real-card:
-	cargo test --features $(TEST_FEATURES),dangerous-test-real-card
+	DANGEROUS_TEST_RUN_REAL_CARD=true cargo test --features $(TEST_FEATURES)
 
 .PHONY: check
 check:
@@ -32,12 +32,12 @@ lint:
 
 .PHONY: tarpaulin
 tarpaulin:
-	cargo tarpaulin --features $(TEST_FEATURES) -o Html -o Xml
+	cargo tarpaulin --engine Llvm --features $(TEST_FEATURES) -o Html -o Xml
 
 .PHONY: vpicc-example
 vpicc-example:
-	cargo run --example vpicc --features vpicc,rsa
+	cargo run --example vpicc
 
 .PHONY: ci
-ci: lint tarpaulin
+ci: lint test
 

ci/Dockerfile

@@ -1,27 +1,26 @@
 FROM docker.io/rust:latest
 
-RUN apt update && apt install --yes  libpcsclite-dev \
-  && wget https://github.com/arekinath/pivy/releases/download/v0.10.0/pivy-0.10.0-src.tar.gz \
-  && tar xvf pivy-0.10.0-src.tar.gz \
-  && cd pivy-0.10.0 \
-  && make pivy-tool
+RUN apt update && apt install --yes ragel libpcsclite-dev libbsd-dev \
+  && wget https://github.com/arekinath/pivy/archive/refs/tags/v0.12.1.tar.gz \
+  && tar xvf v0.12.1.tar.gz
 
-FROM docker.io/rust:latest
+RUN cd pivy-0.12.1 && sed -i '1s/^/\#include \<sys\/stat.h\>\n/' bunyan.c
+RUN cd pivy-0.12.1 && make pivy-tool
 
-RUN apt update && apt install --yes scdaemon libclang-dev llvm python3-pip vsmartcard-vpcd pkg-config nettle-dev libpcsclite-dev opensc
+FROM docker.io/rust:latest
 
-RUN python3 -m pip install reuse
+RUN apt update && apt install --yes scdaemon libclang-dev llvm python3-pip vsmartcard-vpicc pkg-config nettle-dev libpcsclite-dev opensc libbsd-dev 
 
 RUN rustup component add clippy rustfmt && rustup target add thumbv7em-none-eabi
 RUN cargo install cargo-tarpaulin --profile release && rm -rf "$CARGO_HOME"/registry
-# initialize cargo cache
-RUN cargo search
 
 ENV CARGO_HOME=/app/.cache/cargo
 
-COPY --from=0 pivy-0.10.0/pivy-tool /bin/pivy-tool
+COPY --from=0 pivy-0.12.1/pivy-tool /bin/pivy-tool
 
 WORKDIR /app
 
+LABEL org.opencontainers.image.source https://github.com/trussed-dev/piv-authenticator
+
 COPY entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/bin/bash", "/entrypoint.sh"]

ci/Makefile

@@ -1,6 +1,6 @@
 -include config.mk
 
-TAG := registry.git.nitrokey.com/nitrokey/piv-authenticator/piv-authenticator-build
+TAG := ghcr.io/trussed-dev/piv-authenticator:latest
 DOCKER ?= docker
 FUZZ_JOBS?=$(shell nproc)
 FUZZ_DURATION?="0"

dev-vpicc/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "dev-vpicc"
+version = "0.1.0"
+edition = "2024"
+
+[dependencies]
+iso7816 = "0.2.0"
+heapless = "0.9"
+vpicc = "0.1.0"
+piv-authenticator = { path = ".." }
+log = "0.4"
+trussed-rsa-alloc = { version = "0.4", features = ["raw"] }
+trussed = { version = "0.1", default-features = false, features = ["aes256-cbc", "chacha8-poly1305", "crypto-client", "ed255", "filesystem-client", "p256", "p384", "shared-secret", "serde-extensions", "tdes", "x255", "virt"]  }
+trussed-auth-backend = "0.1.0"
+trussed-staging = { version = "0.4", features = ["chunked", "hpke", "wrap-key-to-file"], default-features = false }
+trussed-wrap-key-to-file = "0.3.0"
+trussed-hpke = "0.3.0"
+trussed-chunked = "0.3.0"
+trussed-auth = "0.5"

dev-vpicc/src/lib.rs

@@ -0,0 +1,2 @@
+pub mod virt;
+pub mod vpicc;

src/virt.rs → dev-vpicc/src/virt.rs

@@ -3,7 +3,7 @@
 pub mod dispatch {
 
     use trussed::{
-        api::{reply, request, Reply, Request},
+        api::{Reply, Request, reply, request},
         backend::{Backend as _, BackendId},
         error::Error,
         platform::Platform,
@@ -15,7 +15,6 @@ pub mod dispatch {
     use trussed_auth_backend::{AuthBackend, AuthContext, FilesystemLayout, MAX_HW_KEY_LEN};
     use trussed_chunked::ChunkedExtension;
     use trussed_hpke::HpkeExtension;
-    #[cfg(feature = "rsa")]
     use trussed_rsa_alloc::SoftwareRsa;
     use trussed_staging::{StagingBackend, StagingContext};
     use trussed_wrap_key_to_file::WrapKeyToFileExtension;
@@ -24,15 +23,13 @@ pub mod dispatch {
     pub const BACKENDS: &[BackendId<Backend>] = &[
         BackendId::Custom(Backend::Staging),
         BackendId::Custom(Backend::Auth),
-        #[cfg(feature = "rsa")]
         BackendId::Custom(Backend::Rsa),
         BackendId::Core,
     ];
 
     #[derive(Debug, Clone, Copy)]
     pub enum Backend {
         Auth,
-        #[cfg(feature = "rsa")]
         Rsa,
         Staging,
     }
@@ -129,7 +126,6 @@ pub mod dispatch {
                     request,
                     resources,
                 ),
-                #[cfg(feature = "rsa")]
                 Backend::Rsa => SoftwareRsa.request(&mut ctx.core, &mut (), request, resources),
             }
         }
@@ -182,7 +178,6 @@ pub mod dispatch {
                     }
                     Extension::Auth => Err(Error::RequestNotAvailable),
                 }
-                #[cfg(feature = "rsa")]
                 Backend::Rsa => Err(Error::RequestNotAvailable),
             }
         }

src/vpicc.rs → dev-vpicc/src/vpicc.rs

@@ -1,10 +1,12 @@
-use iso7816::{command::FromSliceError, Command, Status};
+use iso7816::{Command, Status, command::FromSliceError};
 
 use crate::virt::VirtClient;
 
 use std::convert::{TryFrom, TryInto};
 
-use crate::Authenticator;
+use piv_authenticator::Authenticator;
+
+use log::{trace, warn};
 
 const REQUEST_LEN: usize = 7609;
 const RESPONSE_LEN: usize = 7609;

examples/vpicc.rs

@@ -8,14 +8,15 @@
 
 // TODO: add CLI
 
-use piv_authenticator::{virt::with_ram_client, Authenticator, Options};
+use dev_vpicc::{virt::with_ram_client, vpicc::VpiccCard};
+use piv_authenticator::{Authenticator, Options};
 
 fn main() {
     env_logger::init();
 
     with_ram_client("piv-authenticator", |client| {
         let card = Authenticator::new(client, Options::default());
-        let mut vpicc_card = piv_authenticator::vpicc::VpiccCard::new(card);
+        let mut vpicc_card = VpiccCard::new(card);
         let vpicc = vpicc::connect().expect("failed to connect to vpicc");
         vpicc
             .run(&mut vpicc_card)

src/constants.rs

@@ -43,29 +43,27 @@ pub const YUBICO_DEFAULT_MANAGEMENT_KEY_ALG: AdministrationAlgorithm =
     AdministrationAlgorithm::Tdes;
 
 pub const DISCOVERY_OBJECT: [u8; 18] = hex!(
-    "
-    4f 0b // PIV AID
-       a000000308000010000100
-    5f2f 02 // PIN usage Policy
-         4010"
+    "4f 0b" // PIV AID
+       "a000000308000010000100"
+    "5f2f 02" // PIN usage Policy
+         "4010"
 );
 
 pub const CARD_CAP: [u8; 27] = hex!(
-    "
-    F0 00 // card identifier
-    F1 00 // capability container version
-    F2 00 // capability container grammar
-    F3 00 // application card url
-    F4 00 // pkcs15
-    F5 01 10 // registereddata model number
-    F6 00 // access control rule table
-    F7 00 // card apdus
-    FA 00 // redirection tag
-    FB 00 // capability tuples
-    FC 00 // status tuples
-    FD 00 // next ccc
-    FE 00 // Error detection code
-"
+    "F0 00" // card identifier
+    "F1 00" // capability container version
+    "F2 00" // capability container grammar
+    "F3 00" // application card url
+    "F4 00" // pkcs15
+    "F5 01 10" // registereddata model number
+    "F6 00" // access control rule table
+    "F7 00" // card apdus
+    "FA 00" // redirection tag
+    "FB 00" // capability tuples
+    "FC 00" // status tuples
+    "FD 00" // next ccc
+    "FE 00" // Error detection code
+
 );
 
 pub const PRINTED_INFORMATION: [u8; 63] = hex!(